vulns.co
/
GKData.io MCP

Back to Playbooks

Cookie and session binding

Decide which cookies are the session, then check scope, flags, and whether logout actually kills them. SameSite, the __Host- prefix, and Partitioned (CHIPS) are properties of that decision, not a checklist of headers.

Tags: session, cookie, csrf

Level: intermediate

Method

  1. List every Set-Cookie

    Capture anonymous browse, login, and refresh. Mark session, CSRF, device, load balancer, and analytics. Only the session cookie gets the rest of this page.

    Tools: Burp Suite, browser

  2. Flags and name prefix

    Secure, HttpOnly, SameSite, and Path. A __Host- prefix also requires Secure, no Domain attribute, and Path=/. If the name claims that and the attributes do not match, the browser will ignore the prefix rules or reject the cookie. Record which one you observed.

    Tools: browser

  3. Domain scope

    Host-only versus a parent Domain. A parent-domain session cookie is sent to sibling hosts. That is a gadget until a sibling you can influence receives it.

    Tools: Burp Suite

  4. Rotation

    Compare the value before login, after login, after a privilege change, and after logout. Note whether the previous value still works.

    Tools: Burp Suite

  5. Refresh tokens

    Logout that clears the cookie and leaves the refresh token valid is not logout. Record the refresh request before and after.

    Tools: Burp Suite

  6. Fixation

    If the anonymous value and the authenticated value are the same session id, the server did not issue a new one at login.

    Tools: Burp Suite

Field notes

  • Partitioned ties a cookie to the top-level site. CHIPS is supported in current Chrome and Firefox. Safari does not implement it. Say which browser sent the cookie.
  • SameSite is a browser control. Confirm the server also checks a CSRF token or a custom header on state-changing routes.
  • HttpOnly stops script from reading the cookie. It does not stop the browser from sending it.

References